Splunk Search

rex field extraction

anoopambli
Communicator

I am getting familiar with splunk commands, trying to extract hostname from an extracted field called monitor_name. monitor_name field data look like this,

[Linux][FWA Electronic Channel Messaging][l91oma1][Process][SS][/fiwlspoma4/was/INSTANCE1/profiles/base/servers/server1][error]
[Linux][Baseline][vlrtp569][Process][OSWatcher][SiSExclude]
[Linux][Baseline][vlrtp123][Process][srmclient][SiSExclude]

I would like to extract l91oma1, vlrtp569,vlrtp123 from the above field using rex command. Can someone help me with the regular expression.

Tags (1)
0 Karma

chimell
Motivator

Hi anoopambli

This search code work well

...................................|rex max_match=0 field=_raw "\[Linux\]\[[a-zA-Z\s+]+\]\[(?<monitor_name>[^\]]+)\]"|mvexpand monitor_name|table monitor_name

Look at my result

alt text

0 Karma

kml_uvce
Builder

use this

rex field=_raw "^(?:[^\[\n]*\[){3}(?P<fieldname>\w+)"
kamal singh bisht
0 Karma

aholzer
Motivator

@kml_uvce your escaping backslashes were lost since you forgot to use the "code" tags around your regex. The regex should actually look like below:

rex field=_raw "^(?:[^\[\n]*[){3}(?P<fieldname>w+)"
0 Karma

somesoni2
Revered Legend

And there is backslash missing before "w+" as well. So it should be

rex field=_raw "^(?:[^\[\n]*[){3}(?P<fieldname>\w+)"
0 Karma

anoopambli
Communicator

Thanks everyone, that helped me.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...